Credential management doesn't seem to work on Ubuntu or CentOS

[raymond-ensemble]

When I tried to run the user-sync with the credential management keyring, I get this error with the keyrings.alt.

CRITICAL main - umapi.primary configuration.enterprise: Error accessing secure storage: No recommended backend was available. Install the keyrings.alt package if you want to use the non-recommended backends. See README.rst for details.

When I check the keyrings.alt installation, it says requirement already satisfied.

pip install keyrings.alt
Requirement already satisfied: keyrings.alt in /usr/lib/python2.7/site-packages
Requirement already satisfied: six in /usr/lib/python2.7/site-packages (from keyrings.alt)

I was just running a normal user-sync

./user-sync --users file users-file.csv --process-groups --adobe-only-user-action exclude

[ianmak]

Just to clarify, normally we wouldn't run user-sync with keyrings.alt. We tried it just to see if it would satisfy the tool, but it still complained.

A bit more information:

I tried setting up VM's running desktop versions of centos and ubuntu for Raymond to test the secure credentials feature, and to see if that would satisfy the keyrings requirement, but it always complains that no recommended backend was available.

I tried looking into this, and I run into the same problem from the python command line using the following lines:

python
$ import keyring
$ key.get_password(service_name='test_service', username='test_username')
*** No recommended backend was available error ***

I was able to have the system pick up the password values by also installing via pip secretstorage, cffi, dbus-python, it no longer complains that no recommended backend was available and is able to read passwords you see in the "Passwords and Keys" > Login panel.

I tried updating user-sync to also bundle these packages into the app, but it still complains that no recommended backend was available. Though strangely, if I make the keyring.get_password call at the beginning of the app (before even main is called), keyring has no problems retrieving secret service values. So not sure if it's getting confused somewhere between the beginning of the app and at the keyring configuration value loading point or something...

[ianmak]

I am also planning to arrange a kubuntu VM so I can try kwallet, but so far we've had no luck retrieving credentials on ubuntu and centos from within user-sync, except in the modified app scenario I noted previously.

[adobeDan]

@raymond-ensemble @ianmak All of the dbus-based secure storage solutions require an OS-installed dbus package that matches the Python package. So, for example, it's not enough to install dbus-python, you have to install the OS-provided dbus package for the keyring type you are using (Gnome or whichever). Can you make sure you have the appropriate system package installed and then see whether you can reproduce this error?

[ianmak]

ah I'll try to look into this a little more closely... though for some reason the keyring is able to read the secure credentials in the python command line, not sure why it fails from within user-sync...

[ianmak]

hmm as far as I know it, the dbus package is installed in the system... if I enter dpkg -l | grep keyring, I see the packages gnome-keyring and ubuntu-keyring are installed.

If I add the secretstorage and dbus-python libraries to setup.py and requirements.txt and rebuild, the error disappears and the sync tool completes properly... any idea why it's behaving like this on ubuntu?

[adobeDan]

Ah! Yes, I do know why this is happening: pex refuses to use available system libraries when executing a package. So, when you run python at top level, and have installed gnome-keyring and ubuntu-keyring, it finds them and uses them. But, when you run User Sync, it can't find them because they are not in the pex package. But when you update setup.py and requirements.txt and rebuild, they are in the pex package and so User Sync finds them.

So this really is a bug, and needs to be fixed by updating setup.py and requirements.txt. And, while you're there, please make sure that the two sets of requirements are fully synchronized, because I think I forgot to update the minimum acceptable umapi_client in requirements.txt. Assigning this to you for a fix; please do the fix in a branch off the current v2 branch and submit a PR. Nice work getting to the bottom of this!

[adobeDan]

@ianmak I have assigned this to you. Also will you please investigate: I don't think we need any entries in requirements.txt that are also in setup.py, because the pex builder always runs the python setup tools which install all the right setup.py requirements. I think we probably can let requirements.txt be empty except in the windows-specific versions where we go get the necessary platform-specific build.

[ianmak]

sure thing thanks for the insight, I'll take care of this!